Loading vulnerability…
Sandboxed Code Execution in Google Chrome V8
CVE-2026-118359 is a high-severity memory corruption vulnerability in the V8 engine in Google Chrome versions before 156.0.8078.73. Processing a crafted HTML page could allow a remote attacker to execute arbitrary code inside the browser sandbox. Chromium-based Microsoft Edge is also affected. The specific vulnerable function and underlying memory-corruption mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise the confidentiality, integrity, and availability of the affected sandboxed browser process through arbitrary code execution. This vulnerability alone does not establish a sandbox escape or code execution with unrestricted operating-system privileges.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are installed, reduce exposure to untrusted web pages through web filtering and restrictions on unnecessary JavaScript and downloads. Retain browser sandboxing and available anti-exploitation protections, and run the browser without administrative privileges. These defense-in-depth measures do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to version 156.0.8078.73 or later; the corresponding Windows and macOS Stable updates are 156.0.8078.73/.74. Upgrade Microsoft Edge to version 156.0.4314.58 or later. For distribution-managed Chromium, install the applicable vendor security update; Debian trixie includes the fix in version 156.0.8078.73-1~deb13u1. Update affected Chromium libraries and related packages, relaunch the browser, and verify the installed version. Fedora updates additionally instruct users to log out and back in.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.